Approved version
- Version
- 2026-10-24.v2
- Version date
- Language
- English
Provider and Subprocessor Register
Version: 2026-10-24.v2
This register explains the services used by iDeployed and their respective functions. Where incorporated as DPA Annex C, authorisation is limited to the stated activities and entrusted data actually processed. Naming a provider does not replace necessary agreements or lawful transfer safeguards. The providers’ own processing is additionally governed by their privacy notices.
1. Hosting and transmission of application data
| Provider | Activity and data | Processing and provider information |
|---|---|---|
| Scaleway SAS, 8 rue de la Ville l’Évêque, 75008 Paris, France | Compute, platform database, persistent storage, registry and object storage; application contents, databases, code, logs and technical metadata depending on the engagement. | Our primary infrastructure is in France, Paris region. Support and further subprocessing follow the applicable agreement and Scaleway subprocessor list (opens in a new tab). Contracts and data protection (opens in a new tab). |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | Proxy, TLS and network protection for platform and application traffic routed through Cloudflare. This can involve HTTP contents, domains, IP addresses and connection information. | Global processing, including the USA; no promise of exclusively EU processing. The Cloudflare DPA (opens in a new tab) includes EU Standard Contractual Clauses for the transfers it specifies. Privacy notice (opens in a new tab). Custom domains may use a different route. |
Self-hosted Grafana, Loki and Prometheus run in our Scaleway environment. They are not additional Grafana Cloud services engaged here.
2. Contact, account administration and operational services
For our own contact and account activities, these services may act as processors for iDeployed. If support or troubleshooting actually requires data entrusted by you, the relevant service is a subprocessor to that extent. Use of these services does not mean every provider receives all of your application contents.
| Service | Purpose and data | Locations and privacy information |
|---|---|---|
| Zoho Mail / Zoho group | Support, privacy and legal mailboxes; senders, recipients, messages, attachments and connection information. This is not the default email service for your hosted application. | We use mail.zoho.eu with EU storage. Zoho identifies possible support access by Zoho Corporation Private Limited in India with contractual transfer safeguards. Its current contracting-entity list (opens in a new tab) names Zoho Corporation GmbH for Germany; Zoho Corporation B.V. is also relevant to EU infrastructure. Privacy and location information (opens in a new tab), DPA information (opens in a new tab). The EU mailbox address does not rule out third-country access. |
| Resend / Plus Five Five, Inc., USA | Transactional account and security emails; email address, message content and delivery information. | Data storage in the USA even with a European sending region. DPA with transfer clauses (opens in a new tab), storage information (opens in a new tab), subprocessors (opens in a new tab). |
| Cloudflare Turnstile / Cloudflare, Inc. | Protecting registration and—where enabled—new online-withdrawal receipts against automated abuse. The browser widget communicates directly with Cloudflare and can process signals including the IP address, TLS fingerprint, User-Agent, sitekey/origin and other technical browser/device signals. It creates a short-lived token that can be validated only once. Our server sends only that token to Siteverify, not an additional IP address as remoteip and no name, contract identifier, receipt email or information read from an account; the result is checked locally for action and hostname. This check neither searches for an account nor verifies identity or legal validity. The token and verification result do not form part of the declaration, fingerprint, receipt or browser recovery material. | Cloudflare describes processing on behalf of the website and independent controller processing to improve bot detection. The global-processing and transfer information stated above for Cloudflare also applies here. Turnstile Privacy Addendum (opens in a new tab). |
| Slack / Salesforce group | Internal technical events with time, error code, resource/support reference and dashboard link. The intended event format contains no raw application logs or credentials. | International processing is possible; no exclusive EU-storage promise is made. Privacy information (opens in a new tab) and contract information (opens in a new tab) describe the applicable entities and data-protection terms. |
| Better Stack | Availability monitoring of public platform endpoints and operational notifications; URL, status/response data and operational contacts. No general forwarding of customer application logs. | Its DPA (opens in a new tab) identifies the contracting company through the ordering document and provides for international processing, including the USA, with the adequacy/Standard Contractual Clause mechanisms described there. A public provider statement alone does not establish an account's region. |
3. Optional connections and independent recipients
GitHub: A connection can involve authorised repository, installation and commit metadata, source code, webhooks and build interactions. The Customer's own agreement and the integration determine the roles. GitHub does not automatically receive every hosted database's contents. GitHub Privacy Statement (opens in a new tab).
Container registries: Docker Hub, GHCR and supported private registries receive image/version details, connection information and necessary authorised credentials where applicable for requested pulls. The operator and processing depend on the selected registry.
Certificate and domain services: TLS certificate authorities such as Google Trust Services for Cloudflare certificates and Let’s Encrypt with corresponding origin configuration process issuance and validation data. Certificate and domain information can become public. Certificate issuance alone does not transfer application contents to the authority. Google Trust Services (opens in a new tab), Let’s Encrypt (opens in a new tab).
Payments: Paid checkout and live billing are disabled. This version does not describe Stripe as an active payment service for customer orders. Recipients, roles and transfers will be added before payments are introduced.
4. Changes and evidence
Subprocessor changes are notified at least 30 days in advance under the DPA. Objections and their handling follow the DPA. The version incorporated into your agreement remains identifiable; a new provider webpage does not automatically amend your DPA.
Questions, evidence requests and privacy matters: [email protected]. Technical assistance: [email protected]. On request, we explain the provider, location and transfer arrangements applied to the particular engagement and provide information about relevant safeguards. Send only data actually necessary for support.